ZDI-07-053
 
Microsoft ISA Server SOCKS4 Proxy Connection Leakage
http://www.zerodayinitiative.com/advisories/ZDI-07-053.html

September 20, 2007

CVE ID:
CVE-2007-4991 

Affected Vendor:
Microsoft 

Affected Products:
ISA Server 2004 SP1
ISA Server 2004 SP2 

TippingPointTM IPS Customer Protection:
TippingPoint IPS customers have been protected against this vulnerability since September 20, 2007 
by Digital Vaccine protection filter ID 4085. For further product information on the TippingPoint IPS: 

    www.tippingpoint.com 

Vulnerability Details:
This vulnerability allows remote attackers to extract IP addresses visited through the SOCKS4 
Proxy on vulnerable ISA Server installations. Authentication is not required to exploit this 
vulnerability.

This specific flaw exists when an empty packet is sent to the SOCKS4. The server will return a 
packet containing the last IP address it proxied to. 

Vendor Response:
Microsoft has issued an update to correct this vulnerability. More details can be found at:

    Microsoft ISA Server 2004 SP3 

Disclosure Timeline:
2006.01.30 - Vulnerability reported to vendor 
2007.09.20 - Digital Vaccine released to TippingPoint customers 
2007.09.20 - Coordinated public release of advisory 


Credit:
This vulnerability was discovered by CIRT.DK. 

About the Zero Day Initiative (ZDI):
Established by TippingPoint, a division of 3Com, The Zero Day Initiative (ZDI) represents a 
best-of-breed model for rewarding security researchers for responsibly disclosing discovered 
vulnerabilities. 

Researchers interested in getting paid for their security research through the ZDI can find 
more information and sign-up at: 

    www.zerodayinitiative.com 

The ZDI is unique in how the acquired vulnerability information is used. 3Com does not 
re-sell the vulnerability details or any exploit code. Instead, upon notifying the affected 
product vendor, 3Com provides its customers with zero day protection through its intrusion 
prevention technology. Explicit details regarding the specifics of the vulnerability are not 
exposed to any parties until an official vendor patch is publicly available. Furthermore, 
with the altruistic aim of helping to secure a broader user base, 3Com provides this vulnerability 
information confidentially to security vendors (including competitors) who have a vulnerability 
protection or mitigation product.